Resources in restricted subpage still visible

[sim3083]

Hello We were alerted to an issue which has caused a bit of a security breach in our system. We have set up a subpage with restricted access to only members of a management group. These contain files that have model answer documents that can be reviewed by managers and the like. As it turns out, resources in the subpage can be accessed through the activities block when clicking on “resources” (or the dropdown option using the Essential theme, assuming it uses the same renderer). We believe this is an oversight in the plugin; the same scenario using a normal “Topic” complies with any access restrictions set. Can anyone be of any assistance to a quick fix as opposed to adding restrictions to individual files? We would like to retain the functionality of one place where learners can view all the resources in the course (that they are allowed to see). Thanks

[sammarshallou]

Hi,

Unfortunately this is expected behaviour. Because the way the subpage works (it's an activity that owns sections) isn't really supported natively in Moodle, it isn't possible for the subpage to directly affect visibility of other activities that are 'within' it, because Moodle doesn't know that those activities are inside the subpage. We did lobby at one point to get relevant features added to core Moodle, but this was considered and rejected.

The easiest solution is to add restrictions to the sections in the subpage. That way you at least don't have to restrict individual items one by one. You can have a policy that if staff set any restrictions on the subpage, they should also set those same restrictions on each section in the subpage. (Section restrictions actually do apply to the items within the section.)

[sammarshallou]

I should also note that we did do some hacks within our theme which sort of implemented the expected behaviour. If you're willing to hack the theme you can do this too - basically, we made it so that on every page, the theme checks whether it's an activity that is within a subpage, and if so, it checks whether the subpage has 'uservisible' set. So this might be the most complete technical solution, but it requires a change to your theme.

(I had a quick look but can't actually find the code that implements this... However it should be possible.)

[sim3083]

Thanks for the explanation

Hiding the section does the trick

Cheers